Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    23/10/2023, 17:15

General

  • Target

    NEAS.69585ae659cf7e13dd4c48f8d3109c5e219cb37f266a3aed6d0e0aac051e89b2exe_JC.exe

  • Size

    456KB

  • MD5

    6ebb994d00938e37d43b4cb66fd5356d

  • SHA1

    48a7117f5ed601381d744f949b66529e52251343

  • SHA256

    69585ae659cf7e13dd4c48f8d3109c5e219cb37f266a3aed6d0e0aac051e89b2

  • SHA512

    d9de4847d0cc0d9073bd8b4f6062014c37d9394baf8aeb912af5ad3078401e1a8ad25abfe943100f4c41cb64561d3e5bd2f8835cd881f0658ff9ebc8b2681266

  • SSDEEP

    12288:KfLRrNGaW112bN1wW5I1UrqNnEKiIYZ6U0RsRJVlBMlh:KfL5NGa01WN5gEf6Wpoh

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

ge06

Decoy

azaharparis.com

nationaleventsafety.com

covesstudy.com

quinshon4.com

moderco.net

trailblazerbaby.com

time-edu.net

azeemtourism.com

anakmedan3.click

bookinternationaltours.com

ulksht.top

newswirex.com

dingg.net

waveoflife.pro

miamirealestatecommercial.com

rtplive77.xyz

bowllywood.com

automation-tools-84162.bond

booptee.com

ebx.lat

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook payload 5 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Users\Admin\AppData\Local\Temp\NEAS.69585ae659cf7e13dd4c48f8d3109c5e219cb37f266a3aed6d0e0aac051e89b2exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.69585ae659cf7e13dd4c48f8d3109c5e219cb37f266a3aed6d0e0aac051e89b2exe_JC.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Users\Admin\AppData\Local\Temp\heooiabir.exe
        "C:\Users\Admin\AppData\Local\Temp\heooiabir.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2492
        • C:\Users\Admin\AppData\Local\Temp\heooiabir.exe
          "C:\Users\Admin\AppData\Local\Temp\heooiabir.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2148
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\heooiabir.exe"
        3⤵
          PID:2732

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\fqytpufty.s

            Filesize

            205KB

            MD5

            f8dfd353d09136096e0996463892f727

            SHA1

            33ded541f75bc169cd2410cb5105b1fd9b372eb6

            SHA256

            9fffdcedea07e45d8f46ece1949d1ab372c89ee427a6015bb99bd40fa2c9e09b

            SHA512

            e0d7db124617b31f350411fd9b4d683b7aa0adbb839696b77a7fc4e0dfcbe72ba4ae58727f490733583adde19120ce700066d15b687ef082e83d1716fd696004

          • C:\Users\Admin\AppData\Local\Temp\heooiabir.exe

            Filesize

            361KB

            MD5

            a7282a909f46de953ab33416ab47ae18

            SHA1

            53c5e1d282046364186554b2a93f1eb0c13ae909

            SHA256

            603f1db91199b78cf2623f62ebaaa2ea2250a37a09b769ff82d1eade19b6b25b

            SHA512

            1e77062609fe86c88d932f649dfc32d58064add893318bb3e27d303a3db7d752704252c74255a4628fe558fb2c15f8c137693455886ae6e722a07d3d133a7b1b

          • C:\Users\Admin\AppData\Local\Temp\heooiabir.exe

            Filesize

            361KB

            MD5

            a7282a909f46de953ab33416ab47ae18

            SHA1

            53c5e1d282046364186554b2a93f1eb0c13ae909

            SHA256

            603f1db91199b78cf2623f62ebaaa2ea2250a37a09b769ff82d1eade19b6b25b

            SHA512

            1e77062609fe86c88d932f649dfc32d58064add893318bb3e27d303a3db7d752704252c74255a4628fe558fb2c15f8c137693455886ae6e722a07d3d133a7b1b

          • C:\Users\Admin\AppData\Local\Temp\heooiabir.exe

            Filesize

            361KB

            MD5

            a7282a909f46de953ab33416ab47ae18

            SHA1

            53c5e1d282046364186554b2a93f1eb0c13ae909

            SHA256

            603f1db91199b78cf2623f62ebaaa2ea2250a37a09b769ff82d1eade19b6b25b

            SHA512

            1e77062609fe86c88d932f649dfc32d58064add893318bb3e27d303a3db7d752704252c74255a4628fe558fb2c15f8c137693455886ae6e722a07d3d133a7b1b

          • \Users\Admin\AppData\Local\Temp\heooiabir.exe

            Filesize

            361KB

            MD5

            a7282a909f46de953ab33416ab47ae18

            SHA1

            53c5e1d282046364186554b2a93f1eb0c13ae909

            SHA256

            603f1db91199b78cf2623f62ebaaa2ea2250a37a09b769ff82d1eade19b6b25b

            SHA512

            1e77062609fe86c88d932f649dfc32d58064add893318bb3e27d303a3db7d752704252c74255a4628fe558fb2c15f8c137693455886ae6e722a07d3d133a7b1b

          • \Users\Admin\AppData\Local\Temp\heooiabir.exe

            Filesize

            361KB

            MD5

            a7282a909f46de953ab33416ab47ae18

            SHA1

            53c5e1d282046364186554b2a93f1eb0c13ae909

            SHA256

            603f1db91199b78cf2623f62ebaaa2ea2250a37a09b769ff82d1eade19b6b25b

            SHA512

            1e77062609fe86c88d932f649dfc32d58064add893318bb3e27d303a3db7d752704252c74255a4628fe558fb2c15f8c137693455886ae6e722a07d3d133a7b1b

          • memory/1236-33-0x0000000000010000-0x0000000000020000-memory.dmp

            Filesize

            64KB

          • memory/1236-30-0x0000000006030000-0x000000000610F000-memory.dmp

            Filesize

            892KB

          • memory/1236-41-0x000007FF21EE0000-0x000007FF21EEA000-memory.dmp

            Filesize

            40KB

          • memory/1236-14-0x0000000000010000-0x0000000000020000-memory.dmp

            Filesize

            64KB

          • memory/1236-40-0x000007FEF5DE0000-0x000007FEF5F23000-memory.dmp

            Filesize

            1.3MB

          • memory/1236-38-0x0000000006330000-0x0000000006489000-memory.dmp

            Filesize

            1.3MB

          • memory/1236-17-0x0000000004130000-0x00000000041F0000-memory.dmp

            Filesize

            768KB

          • memory/1236-37-0x000007FF21EE0000-0x000007FF21EEA000-memory.dmp

            Filesize

            40KB

          • memory/1236-36-0x000007FEF5DE0000-0x000007FEF5F23000-memory.dmp

            Filesize

            1.3MB

          • memory/1236-21-0x0000000006030000-0x000000000610F000-memory.dmp

            Filesize

            892KB

          • memory/1236-22-0x0000000004130000-0x00000000041F0000-memory.dmp

            Filesize

            768KB

          • memory/1236-35-0x0000000006330000-0x0000000006489000-memory.dmp

            Filesize

            1.3MB

          • memory/1236-34-0x0000000006330000-0x0000000006489000-memory.dmp

            Filesize

            1.3MB

          • memory/2148-19-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2148-20-0x00000000003B0000-0x00000000003C4000-memory.dmp

            Filesize

            80KB

          • memory/2148-10-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2148-16-0x0000000000370000-0x0000000000384000-memory.dmp

            Filesize

            80KB

          • memory/2148-15-0x0000000000400000-0x000000000042F000-memory.dmp

            Filesize

            188KB

          • memory/2148-12-0x0000000000740000-0x0000000000A43000-memory.dmp

            Filesize

            3.0MB

          • memory/2492-6-0x0000000000230000-0x0000000000232000-memory.dmp

            Filesize

            8KB

          • memory/2848-28-0x0000000002060000-0x0000000002363000-memory.dmp

            Filesize

            3.0MB

          • memory/2848-29-0x0000000000070000-0x000000000009F000-memory.dmp

            Filesize

            188KB

          • memory/2848-27-0x0000000000070000-0x000000000009F000-memory.dmp

            Filesize

            188KB

          • memory/2848-32-0x0000000001ED0000-0x0000000001F63000-memory.dmp

            Filesize

            588KB

          • memory/2848-26-0x0000000000910000-0x0000000000936000-memory.dmp

            Filesize

            152KB

          • memory/2848-24-0x0000000000910000-0x0000000000936000-memory.dmp

            Filesize

            152KB